The evidence gap: why controls that exist still fail the audit

The most common surprise in a first certification audit is not that a control was missing. It is that a control existed, genuinely operated, and still produced a finding, because nobody could demonstrate that it had operated throughout the period under examination. The control was real. The evidence was not.

This gap between having a control and being able to prove it is where most preparation budgets are actually spent, and it is almost always underestimated at the start of a programme.

What an auditor is actually testing

An auditor examining a control is asking a narrower question than most teams expect. They are not asking whether you are secure. They are asking whether this specific control, as you have described it, operated as described, across the period they are examining, over the population that is in scope.

Each part of that sentence creates a way to fail while remaining, in every practical sense, secure:

• As you described it. If the procedure says quarterly and the record shows twice a year, the finding is against your own description rather than against the standard.
• Across the period. A control that started in month seven of a twelve month window did not operate for the first six, and the report will say so.
• Over the population in scope. Evidence drawn from one environment does not automatically speak for the others, and a sample that was never defined cannot be shown to be representative.

Why the gap opens

It opens because the work and the record of the work are produced by different motivations at different times. The work is done because it is necessary. The record is assembled later because an auditor asked. By then the people who did the work have moved on, the system that would have logged it was replaced, and what remains is a reconstruction.

A reconstruction is a weaker artefact than a record, and an experienced auditor can tell the difference. Screenshots taken in a single afternoon covering twelve months of activity have a texture that gives them away.

Closing it is a design decision, not an effort decision

Teams generally respond to this problem by working harder near the audit date. That is the expensive answer and it does not survive the second year, because the same effort has to be repeated with the same intensity.

The durable answer is to arrange for evidence to be produced as a by-product of the work rather than as a separate exercise afterwards. In practice this means a small number of specific choices:

• Record the control operating at the moment it operates, in a system that timestamps it, rather than noting it for later collection.
• Decide the population and the sampling approach before the period starts, not when the auditor asks how the sample was chosen.
• Keep the description and the practice aligned. Where practice has drifted, change the description deliberately rather than leaving a discrepancy for an auditor to find.
• Treat approval as part of the evidence. An unsigned artefact and an approved one do not carry the same weight, and the difference costs nothing at the time and a great deal later.

The test worth applying early

There is a simple question that surfaces the gap months before an auditor does. Take any control you consider well established and ask: if the person who runs it were unavailable, could a stranger demonstrate from the records alone that it operated every month of the last year?

If the answer depends on a person being in the room to explain, the control is real and the evidence is not.

Applying that question across a control set usually produces a short and uncomfortable list. That list, addressed early, is considerably cheaper than the same list discovered during fieldwork, when the only remaining options are a qualified finding or a delayed certification.